CVE-2026-68763

HighCVSS 7.5/10Last modified Aug 27, 2026

Description

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 27, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-687656.1hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) t CVE-2026-687667.8hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --ou CVE-2026-687676.1hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly th CVE-2026-687686.1hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output CVE-2026-687709.8sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiti CVE-2026-687719.8ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attacker CVE-2026-687728.0ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access CVE-2026-687758.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-687766.5Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687776.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687786.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687796.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.